Attack Guide
What Is a ClickFix Attack? How to Recognize and Stop It
Answer: ClickFix is a social-engineering attack where a fake website tricks you into pressing Windows+R and pasting a malicious command. It bypasses antivirus because you run the command yourself — no malware is downloaded until after you comply.
How does a ClickFix attack work?
ClickFix attacks follow a simple but effective chain:
- You visit a compromised or malicious website, often reached through a phishing email, malvertising, or SEO poisoning.
- The page displays a fake CAPTCHA, a fake error message, or a "verify you are human" prompt.
- The page instructs you to press
Windows + R, thenCtrl + V, thenEnter. - Behind the scenes, the page silently loads a PowerShell, mshta, or cscript command into your clipboard.
- When you paste and press Enter, the Run dialog executes the command, which downloads and installs malware — often a remote access trojan (RAT) like NetSupport, ScreenConnect, or Latrodectus.
Sources: Microsoft Security Blog (August 2025), Palo Alto Unit 42, Fortinet Threat Research.
What are the warning signs of ClickFix?
- A fake CAPTCHA or "verify you are human" prompt on a webpage
- Instructions to press Windows + R, then Ctrl + V, then Enter
- The page silently loads a PowerShell or mshta command into your clipboard
- Urgency language like "verification required to continue" or "access will be locked"
- A spoofed Microsoft Teams, Google Meet, or Docusign page asking you to "continue in browser"
What should you do if you see a ClickFix page?
- Stop immediately. Do not press Win+R or paste anything into any dialog.
- Close the browser tab. If you already pasted and pressed Enter, disconnect from the internet.
- If you ran a command, run a full malware scan with your antivirus software.
- Contact your IT department or security team if this happened on a work device.
- Report the page to your browser's safe-browsing feature or to Google Safe Browsing.
- Scan the suspicious URL or screenshot with PhishGlass to confirm the risk level.
How does PhishGlass detect ClickFix?
PhishGlass is specifically trained to recognize ClickFix, FileFix, and ConsentFix attack patterns. When you scan a suspicious URL or screenshot, PhishGlass checks for:
- Instructions to press Win+R or paste clipboard content
- Fake CAPTCHA or verification prompts used as a pretext
- Silent clipboard injection of PowerShell or mshta commands
- Urgency and authority cues designed to pressure compliance